VOLEXITY_Apt_Malware_Golang_Brickstorm

rule VOLEXITY_Apt_Malware_Golang_Brickstorm : VERDANTBAMBOO BRICKSTORM FILE MEMORY
{
	meta:
		description = "Detects the BRICKSTORM backdoor using common strings."
		author = "threatintel@volexity.com"
		id = "25775278-5115-5873-957f-9c5d0c8e4f5e"
		date = "2025-09-04"
		modified = "2025-10-30"
		reference = "https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2026/2026-06-04 VerdantBamboo/rules.yar#L100-L136"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "40d264cf9c73923932c3dfd52d20f46ff602be3fea8dc6ecc71aca46e6067bf5"
		hash = "e981fc4eaaa6417e6034e21438e55c0360773674a6fc0b63c1b95026449e5254"
		logic_hash = "39e3403d90ad67072ae631273e89fe059ec48906ce1d57fe1afbb91304dc84f3"
		score = 75
		quality = 80
		tags = "VERDANTBAMBOO, BRICKSTORM, FILE, MEMORY"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		report1 = "TIB-20251104"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 12298
		version = 7

	strings:
		$dns1 = "https://1.1.1.1/dns-query" ascii
		$dns2 = "https://8.8.4.4/dns-query" ascii
		$dns3 = "https://8.8.8.8/dns-query" ascii
		$pack1 = "wsshell/core" ascii
		$pack2 = "wssoft/core" ascii
		$s1 = "github.com/hashicorp/yamux" ascii
		$s2 = "winbindd:" ascii
		$s3 = "WEE1=true" ascii
		$s4 = "WEE2=true" ascii

	condition:
		all of ( $dns* ) and all of ( $s* ) and any of ( $pack* )
}